Privacy Policy

Customers are people who create a StatSip account to see analytics for their own websites.

Visitors are people who browse a website that has installed the StatSip script. For visitor data, the website owner is the controller and StatSip processes the data on their behalf.

• Account details: your email address and, if you sign in with Google, your name and profile picture.
• Workspace details: the website domains you add, their timezone and the site key we generate for each one.
• Billing details: plan, billing status and invoices. Card details are handled by our payment provider, Dodo Payments, and never reach our servers.
• Technical data: sign-in session cookies and basic server logs (IP address, browser, time of request) kept to secure and debug the service.

When you choose "Continue with Google", we request only the openid, email and profile scopes. From your Google account we receive your email address, your name and your profile picture URL. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google data.

• How we use it: to create and sign in to your StatSip account, show your name and picture in the app, and send you service emails such as sign-in codes and billing notices.
• How we share it: it is stored with our authentication and database provider, Supabase, and is not sold, rented, or shared with advertisers or data brokers. We do not use it for advertising and do not use it to train AI or machine-learning models.
• How we store and protect it: encrypted in transit (TLS) and at rest, with access limited by row-level security so each account can read only its own data.
• Retention and deletion: kept while your account is open, and deleted within 30 days of you deleting your account or emailing support@statsip.com. You can also remove StatSip's access at any time from your Google account permissions.

StatSip's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When a website uses StatSip, the script sends one event per page view containing:

• the page URL, the referring site, and UTM or ref campaign tags;
• browser, operating system, device type and screen width, derived from the user agent;
• approximate location (country, city, and coordinates rounded to about 10 km), derived from the IP address at the edge;
• a random visitor id stored in a first-party cookie, statsip_vid, on the website's own domain for up to one year, used to count unique visitors and to match a purchase to the visit that led to it.

IP addresses are not stored. If the cookie is blocked, we use a salted hash of the IP address and browser that changes every day and cannot be turned back into an IP address. We do not use third-party cookies, fingerprint across sites, or build profiles of visitors across different websites.

• to provide, run and improve the StatSip dashboard and analytics;
• to sign you in, keep your account secure and prevent abuse;
• to process payments and send receipts;
• to answer support requests and send essential service notices.

We use these service providers, each bound by contract to process data only on our instructions:

• Supabase: authentication and database.
• Cloudflare: hosting, content delivery and event processing.
• Dodo Payments: subscription billing.

We do not sell personal data. We disclose data only if required by law or to protect the rights and safety of our users.

Account data is kept while your account is open. Analytics data is kept for the period of your plan and deleted when you delete the site or your account. Deleted data is removed from backups within 30 days.

You can access, correct, export or delete your data, and object to or restrict its processing, by emailing support@statsip.com. We respond within 30 days. Visitors to a customer's site should contact that website owner first; we will help them fulfil the request. You may also complain to your local data protection authority.

We use TLS for all traffic, encryption at rest, row-level access controls, hashed secrets, and least-privilege access for our team. No system is perfectly secure; if a breach affects your data we will notify you without undue delay.

StatSip is a business tool and is not directed to children under 16. We do not knowingly collect their data.

Our providers may process data outside your country. Where required, transfers are covered by standard contractual clauses or an equivalent safeguard.

We will post changes here and update the date above, and email customers about material changes. Contact us at support@statsip.com.